write_acl (the MCP ACL-editing tool added in #496) locks everyone — including the
caller who just granted themselves Control — out of any non-container resource.
'./' is resolved relative to the .acl documents own location. For a <container>/.acl, that happens to resolve to the container itself; hence existing round-trip test passes
For a resource ACL sitting inside the parent container,
'./' resolves to the parent container, not the resource. checkAuthorizations()
in src/wac/checker.js matches auth.accessTo against the actual resource URL
(auth.accessTo.some(a --> urlMatches(a, targetUrl))) and finds no match —-> resource effectively left with zero authorizations, denying everyone,
including owner who just wrote the ACL granting themselves control.
grep -n "accessTo" src/mcp/tools.js | head -20
308: 'acl:accessTo': { '@id': './' },
write_acl(the MCP ACL-editing tool added in #496) locks everyone — including thecaller who just granted themselves
Control— out of any non-container resource.'./'is resolved relative to the.acldocuments own location. For a<container>/.acl, that happens to resolve to the container itself; hence existing round-trip test passesFor a resource ACL sitting inside the parent container,
'./'resolves to the parent container, not the resource.checkAuthorizations()in
src/wac/checker.jsmatchesauth.accessToagainst the actual resource URL(
auth.accessTo.some(a --> urlMatches(a, targetUrl))) and finds no match —-> resource effectively left with zero authorizations, denying everyone,including owner who just wrote the ACL granting themselves control.
grep -n "accessTo" src/mcp/tools.js | head -20
308: 'acl:accessTo': { '@id': './' },